Files
blis/build/config.mk.in
Sharma, Shubham aa95a8ce4a Added Compiler flags to improve Security (#136)
Following Flags have been added.

1. D_FORTIFY_SOURCE=2
What it does
• At compile time the header files replace certain libc calls (strcpy, sprintf, …) with inline wrappers that perform a compile-time length check whenever the size of the destination buffer is known.
• At run time an extra check is executed only if the compiler could not prove the copy is safe.

Cost
• Only functions that call those specific libc routines pay anything.

2. fstack-protector-strong
What it does
• Functions that contain local arrays, address‐taken locals, or alloca get a canary word inserted into the stack frame.
• The function prologue writes the canary; the epilogue verifies it before the ret.

Cost
• 8 bytes of additional stack per protected function frame.
• Two or three extra instructions per entry/exit.

4. Wl,-z,relro
What it does
• Marks the relocation tables read-only after relocation is finished.
• No effect once the library is fully loaded.

Cost
• None at run time.

5. Wl,-z,now
What it does
• Forces the dynamic loader to resolve all external symbols in the library up-front instead of lazily on first call.

Cost
• Startup: one extra relocation pass.
• Steady-state execution: zero or slightly faster, because PLT stubs are bypassed.

Usage:
cmake -DENABLE_SECURITY_FLAGS=off
cmake -DENABLE_SECURITY_FLAGS=on
configure --enable-security-flags
configure --disable-security-flags

AMD-Internal: [CPUPL-6886]
2025-08-18 16:11:02 +05:30

227 lines
8.7 KiB
Makefile

#
#
# BLIS
# An object-based framework for developing high-performance BLAS-like
# libraries.
#
# Copyright (C) 2014, The University of Texas at Austin
# Copyright (C) 2022 - 2025, Advanced Micro Devices, Inc. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# - Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# - Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
# - Neither the name(s) of the copyright holder(s) nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
# Only include this block of code once
ifndef CONFIG_MK_INCLUDED
CONFIG_MK_INCLUDED := yes
# The version string. This could be the official string or a custom
# string forced at configure-time.
VERSION := @version@
# The shared library .so major and minor.build version numbers.
SO_MAJOR := @so_version_major@
SO_MINORB := @so_version_minorbuild@
SO_MMB := $(SO_MAJOR).$(SO_MINORB)
# The name of the configuration family.
CONFIG_NAME := @config_name@
# The list of sub-configurations associated with CONFIG_NAME. Each
# sub-configuration in CONFIG_LIST corresponds to a configuration
# sub-directory in the 'config' directory. See the 'config_registry'
# file for the full list of registered configurations.
CONFIG_LIST := @config_list@
# This list of kernels needed for the configurations in CONFIG_LIST.
# Each item in this list corresponds to a sub-directory in the top-level
# 'kernels' directory. Oftentimes, this list is identical to CONFIG_LIST,
# but not always. For example, if configuration X and Y use the same
# kernel set X, and configuration W uses kernel set Q, and the CONFIG_LIST
# might contained "X Y Z W", then the KERNEL_LIST would contain "X Z Q".
KERNEL_LIST := @kernel_list@
# This list contains some number of "kernel:config" pairs, where "config"
# specifies which configuration's compilation flags (CFLAGS) should be
# used to compile the source code for the kernel set named "kernel".
KCONFIG_MAP := @kconfig_map@
# The operating system name, which should be either 'Linux' or 'Darwin'.
OS_NAME := @os_name@
# Check for whether the operating system is Windows.
IS_WIN := @is_win@
# The directory path to the top level of the source distribution. When
# building in-tree, this path is ".". When building out-of-tree, this path
# is path used to identify the location of configure. We also allow the
# includer of config.mk to override this value by setting DIST_PATH prior
# to including this file. This override option is employed, for example,
# when common.mk (and therefore config.mk) is included by the Makefile
# local to the 'testsuite' directory, or the 'test' directory containing
# individual test drivers.
ifeq ($(strip $(DIST_PATH)),)
DIST_PATH := @dist_path@
endif
# The C compiler.
CC_VENDOR := @CC_VENDOR@
CC := @CC@
# Gather details of compiler version
CC_MAJOR := @cc_major@
CC_MINOR := @cc_minor@
CC_REVISION := @cc_revision@
# Important C compiler ranges.
GCC_OT_4_9_0 := @gcc_older_than_4_9_0@
GCC_OT_6_1_0 := @gcc_older_than_6_1_0@
GCC_OT_9_1_0 := @gcc_older_than_9_1_0@
GCC_OT_11_2_0 := @gcc_older_than_11_2_0@
# The C++ compiler. NOTE: A C++ is typically not needed.
CXX := @CXX@
# Static library indexer.
RANLIB := @RANLIB@
# Archiver.
AR := @AR@
# Python Interpreter
PYTHON := @PYTHON@
# Preset (required) CFLAGS and LDFLAGS. These variables capture the value
# of the CFLAGS and LDFLAGS environment variables at configure-time (and/or
# the value of CFLAGS/LDFLAGS if either was specified on the command line).
# These flags are used in addition to the flags automatically determined
# by the build system.
CFLAGS_PRESET := @cflags_preset@
LDFLAGS_PRESET := @ldflags_preset@
# The level of debugging info to generate.
DEBUG_TYPE := @debug_type@
# Whether operating system support was requested via --enable-system.
ENABLE_SYSTEM := @enable_system@
# The requested threading model.
THREADING_MODEL := @threading_model@
# Whether the compiler supports "#pragma omp simd" via the -fopenmp-simd option.
PRAGMA_OMP_SIMD := @pragma_omp_simd@
# The installation prefix, exec_prefix, libdir, includedir, and shareddir
# values from configure tell us where to install the libraries, header files,
# and public makefile fragments. We must first assign each substituted
# @anchor@ to its own variable. Why? Because the subsitutions may contain
# unevaluated variable expressions. For example, '@libdir@' may be replaced
# with '${exec_prefix}/lib'. By assigning the anchors to variables first, and
# then assigning them to their final INSTALL_* variables, we allow prefix and
# exec_prefix to be used in the definitions of exec_prefix, libdir,
# includedir, and sharedir.
prefix := @prefix@
exec_prefix := @exec_prefix@
libdir := @libdir@
includedir := @includedir@
sharedir := @sharedir@
# Notice that we support the use of DESTDIR so that advanced users may install
# to a temporary location.
INSTALL_LIBDIR := $(DESTDIR)$(libdir)
INSTALL_INCDIR := $(DESTDIR)$(includedir)
INSTALL_SHAREDIR := $(DESTDIR)$(sharedir)
#$(info prefix = $(prefix) )
#$(info exec_prefix = $(exec_prefix) )
#$(info libdir = $(libdir) )
#$(info includedir = $(includedir) )
#$(info sharedir = $(sharedir) )
#$(error .)
# Whether to output verbose command-line feedback as the Makefile is
# processed.
ENABLE_VERBOSE := @enable_verbose@
# Whether we are building out-of-tree.
BUILDING_OOT := @configured_oot@
# Whether we need to employ an alternate method for passing object files to
# ar and/or the linker to work around a small value of ARG_MAX.
ARG_MAX_HACK := @enable_arg_max_hack@
# Whether to build the static and shared libraries.
# NOTE: The "MK_" prefix, which helps differentiate these variables from
# their corresonding cpp macros that use the BLIS_ prefix.
MK_ENABLE_STATIC := @enable_static@
MK_ENABLE_SHARED := @enable_shared@
# Whether to use an install_name based on @rpath.
MK_ENABLE_RPATH := @enable_rpath@
# Whether to export all symbols within the shared library, even those symbols
# that are considered to be for internal use only.
EXPORT_SHARED := @export_shared@
# Whether to enable either the BLAS or CBLAS compatibility layers.
MK_ENABLE_BLAS := @enable_blas@
MK_ENABLE_CBLAS := @enable_cblas@
# Whether libblis will depend on libmemkind for certain memory allocations.
MK_ENABLE_MEMKIND := @enable_memkind@
# The names of the addons to include when building BLIS. If empty, no addons
# will be included.
ADDON_LIST := @addon_list@
# The name of a sandbox defining an alternative gemm implementation. If empty,
# no sandbox will be used and the conventional gemm implementation will remain
# enabled.
SANDBOX := @sandbox@
# The name of the pthreads library. If --disable-system was given, then this
# variable is set to the empty value.
LIBPTHREAD := @libpthread@
# Complex return scheme configuration
MK_ENABLE_TRSM_PREINVERSION := @enable_trsm_preinversion@
# Complex return scheme configuration
MK_COMPLEX_RETURN_SCHEME := @complex_return@
# Status of aocl dynamic configuration
MK_ENABLE_AOCL_DYNAMIC := @enable_aocl_dynamic@
# BLAS int size
MK_BLAS_INT_TYPE_SIZE := @blas_int_type_size@
MK_IS_ARCH_ZEN := @enable_aocl_zen@
# Security hardening flags (yes/no) as chosen via configure.
MK_ENABLE_SECURITY_FLAGS := @enable_security_flags@
# end of ifndef CONFIG_MK_INCLUDED conditional block
endif